pubspec tweaks, in support of moving towards pub build

Some pubspec tweaks, in support of us eventually moving towards using `pub build` w/ the polymer version of the app. A few blockers currently are:

- pub can't build from the app/ directory
- dart2js is not available as a real pub package
- pub (or pub and the polymer transformer?) don't preserve the CSP output from dart2js

And not a blocker, but annoying:

- pub insists on building every entrypoint in the web/ folder - there's not way currently to scope your build to a single specified entrypoint

@ussuri